Privacy Policy

1. Who is responsible

The controller under the GDPR is Michael Hartmann, c/o POSTFLEX PFX-867-302, Emsdettener Straße 10, 48268 Greven, Germany. Contact: support@lable.chat.

2. What data we process, and why

• Account data: your email address, your password (stored only as a secure hash, never in plain text) and your username. We use it to create and run your account. Legal basis: performing the contract with you (Art. 6(1)(b) GDPR).
• Verification codes: a short-lived 6-digit code is sent to your email to confirm your address, and a link is sent if you reset your password. Legal basis: Art. 6(1)(b) GDPR.
• Login with Google, GitHub or Discord: only if you choose it. We then receive your email address, your name or username and your account ID from that service. Legal basis: Art. 6(1)(b) GDPR.
• Your chats with the AI: the messages you write, the answers of the AI, the chat titles and the pictures the AI creates for you. We store them in our database, linked to your account, so you can continue your chats on any device. Access rules make sure that only you can read your own chats and pictures. We do not read them as a matter of course. We only look at them where necessary to stop abuse, fix errors or meet legal duties. You can delete a chat in the app; this also deletes its pictures. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for security.
• Memory: short notes that the AI saves about you when you share something lasting or ask it to remember something (for example your name or a preference). You can see, add and delete every note in Settings > Memory, switch the memory off, or ask the AI to forget a topic or everything. The notes are stored in your account, and they are sent to the AI service together with your messages so the AI can use them. Legal basis: Art. 6(1)(b) GDPR.
• Limits and abuse protection: we count your messages per account or device, and per time window, to apply the limits of your plan. If very many messages arrive from one network address in a short time, we block that address for a while; for this we store only a keyed hash of the address, never the address itself. If an account is paused for sending too many messages, the text of an appeal you write is stored so we can read it. Legal basis: Art. 6(1)(f) GDPR (security and fair use of the service).
• Storage and plan: the size of your saved chats is measured to apply your storage limit, and your plan (Free, Go or Plus) is stored with your account. Legal basis: Art. 6(1)(b) GDPR.
• Using LableAI without an account (guest): you can send up to 5 messages without signing in. To keep to this limit, your browser creates a random device ID (stored in your browser) and we count the messages for that ID and, as a second protection, for your internet address. The internet address is stored only as a keyed hash that cannot be turned back into the address. The counters are deleted after 60 days. Guest chats are not saved on our servers. Before a guest message is accepted, Cloudflare Turnstile checks that you are not a bot (see section 3). Legal basis: our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR).
• Plan limits: a Free account can send a limited number of messages in every 24-hour period and a Plus account has a fair-use limit. To keep to these limits, we count your messages for the day by your account. The text of the chat is sent to DeepSeek to write the answer, as described below. For accounts that have a usage budget, we also store the amount used. If you choose the Plus plan, we store that your account has the Plus plan (for now this is a test version without payment). Legal basis: Art. 6(1)(b) and (f) GDPR.
• Ratings of answers: if you rate an answer with the thumbs up or down, we store your rating together with your question and the answer (each shortened to 1,500 characters), linked to your account, and the time. Only the operator can read these ratings. We use them to improve LableAI. We delete them when you delete your account or on request. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).
• Your name and profile picture: you give your full name when you create an account. If you upload a profile picture, it is cut to a square, made smaller and stored privately in your account; only you can see it. You can remove it at any time in the Settings. Legal basis: Art. 6(1)(b) GDPR.
• Answers from the AI: to write an answer, the text of the current chat (your messages and the earlier answers, or a short summary of them) is sent to our AI provider DeepSeek. We do not send your email address or username. Please do not write sensitive personal data (for example health data, passwords or ID numbers) into a chat. Legal basis: Art. 6(1)(b) GDPR.
• Intelligent Search: when you switch on Intelligent Search, the AI can look things up. The search words (or the place name for the weather) that it chooses are sent to our server. For web searches our server asks public SearXNG search servers (open-source search that passes the question on to search engines such as Google, Bing or Brave) and then opens a few of the result pages to read them. The results go to DeepSeek together with your question. Searches are counted per account or internet address to limit use.
• Plans (scheduled tasks): when you write a plan in the Plans page, the text is sent to DeepSeek, which turns it into a schedule and an instruction. We save the title, the instruction, the schedule, your time zone and the latest 5 results of each plan in your account. A database job on our server runs the plan at the set time: it asks DeepSeek to write the result and, if needed, searches the web or checks the weather as described below. Plans write text only; they cannot send messages or act outside LableAI. You can pause or delete a plan at any time, which also deletes its results.
• Created pictures: when you use Create image, your description is first sent to DeepSeek, which checks that it is allowed and rewrites it into a short English description. That description is then sent to Cloudflare Workers AI, which makes the picture. The picture is stored privately in your account (in the same storage as your chats, only you can see it) and is deleted when you delete the chat or your account. Together with the picture we save your description and a one- or two-word name for what it shows (for example “dachshund”), so that the Library can gather similar pictures. We count how many pictures you make per day. Please do not put personal data of other people into a description. Pictures are marked as made by an AI: the app shows the label “AI-generated”, and a note is written into the picture file (EU AI Act, Article 50).
• Attached pictures: DeepSeek cannot see pictures, so when you attach one, your browser makes it smaller and sends it to our server, which passes it to a vision model on Cloudflare Workers AI (Llama 3.2 Vision by Meta, run by Cloudflare, Inc., USA). The model sends back a text that describes the picture. Only that text goes to DeepSeek, not the picture. The picture is not saved on our servers, and the description is saved in your chat. If the vision model cannot be reached, the text in the picture is read inside your browser instead and only that text is used. Please do not attach pictures of other people without their agreement.
• Voice: speech input uses the speech recognition built into your browser. Depending on the browser (for example Chrome or Edge), your voice may be processed by the browser maker. We never receive audio, only the text you speak. Spoken answers are played with the voice built into your device.
• Technical data: your IP address, browser type and the time of each request are processed when you use the site. We use it to keep the service secure, stop abuse and fix errors. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

3. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect LableAI from bots. Turnstile is provided by Cloudflare, Inc. It checks technical information about your browser and your IP address to decide whether you are a human. Legal basis: our legitimate interest in protecting the login against abuse (Art. 6(1)(f) GDPR). Its use is subject to the Cloudflare Turnstile Privacy Addendum.

4. Cookies and browser storage

LableAI stores your login session in your browser (local storage, or session storage if you do not tick "Remember me"), together with your "Remember me" choice. It also sets one cookie, lable_gate, that remembers that you entered the access code (up to 30 days). Both are technically necessary. We do not use advertising, tracking or analytics cookies, so no cookie banner is required. The bot check from Cloudflare may use technical storage to work.

5. Who receives your data

• Supabase provides our database, file storage, login system and email delivery and processes your data on our behalf. Our project is hosted in Frankfurt, Germany (EU).
• Hostinger hosts the website and processes server logs, including IP addresses.
• DeepSeek receives the text of your chats to write the answers, as described above. DeepSeek is based in China and may process the data there. China is outside the EU and has no EU adequacy decision, so the level of data protection there can differ from the EU.
• Scaleway (Scaleway SAS, France, servers in the EU) may receive the text of your chats to write the answers instead of DeepSeek, when we switch on this second AI provider. The model there is the open model gpt-oss-120b. Then your chat text does not go to China for that answer.
• ElevenLabs (ElevenLabs, Inc., USA) receives, for Plus accounts that use the voice mode, the short pieces of text of the answers to turn them into speech, and the recording of your voice to write the text of what you said. The audio is not stored by us.
• Public SearXNG servers (run by volunteers in different countries, found through searx.space) and the search engines behind them receive the search words from Intelligent Search. The web pages that are opened can see the address of our server, not yours. Wikipedia (Wikimedia Foundation, USA) and Open-Meteo (open-meteo.com) receive search words and place names as a backup and for the weather. If set up, Tavily (Tavily Inc., USA) can be used instead.
• jsDelivr and projectnaptha.com deliver the text-reading program (Tesseract) and its language files to your browser when you attach a picture. They can see your internet address.
• Cloudflare (Cloudflare, Inc., USA) provides the bot check described above. It also runs the picture maker (Workers AI, model FLUX.1 schnell by Black Forest Labs): it receives the short picture description and returns the picture.
• Google, GitHub and Discord receive data only if you use their login. They are responsible for their own data processing; see their privacy policies.

Some of these providers are based in the USA or in other countries outside the EU. Where data is transferred there, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where available. For DeepSeek in China we have no adequacy decision to rely on; by using the chat you accept that your messages are processed there, and you can decide not to send anything you do not want to be processed there. Whether the transfer is covered by further safeguards is being checked; see the Imprint for how to ask us.

6. How long we keep data

We keep your account data and your chats until you delete them or your account. When an account is deleted, its chats and pictures are deleted too. To delete your account, write to support@lable.chat. Technical logs are kept only for a limited time. We cannot control how long our providers keep data they received to do their work; see their privacy policies.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. You can also complain to a data protection authority, for example the one of your federal state. Contact us at support@lable.chat to use these rights.

8. Age

LableAI is for people aged 16 or older. We do not knowingly collect data from younger people. If we learn that a younger person has an account, we delete it.

9. Security

Data is sent encrypted (HTTPS). Passwords are stored as hashes. Database access rules make sure that you can only read your own account data, chats and pictures. Chats are not end-to-end encrypted.

10. Changes

We may update this policy when LableAI changes. The date at the top shows the latest version.